PT-2025-5971 · Apache · Apache Kvrocks

Sergey Volosatov · Published 2025-02-07 · Updated 2025-07-16 · CVE-2025-25069

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Kvrocks versions 1.0 through 2.11.0

Description A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks did not detect if Host: or POST appears in RESP requests, a valid HTTP request can also be sent to Kvrocks as a valid RESP request and trigger some database operations, which can be dangerous when chained with SSRF. This issue is similar to a previously identified vulnerability in Redis.

Recommendations For Apache Kvrocks versions 1.0 through 2.11.0, upgrade to version 2.11.1, which fixes the issue. As a temporary workaround, consider restricting access to the database operations that can be triggered by the vulnerability until the update is applied.

Fix

Weakness Enumeration

CWE-115

Related Identifiers

CVE-2025-25069

Affected Products

Apache Kvrocks

References · 10

• https://osv.dev/vulnerability/CVE-2025-25069 · Vendor Advisory
• https://lists.apache.org/thread/gbxv9gpsskmdzg6z48zm3tvo8cyo9v3t · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-10517 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-25069 · Security Note
• https://twitter.com/oss_security/status/1888052143166206301 · Twitter Post
• https://t.me/cvedetector/17492 · Telegram Post
• https://t.me/cvenotify/111315 · Telegram Post
• https://twitter.com/CVEnew/status/1887848109360795942 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1887964725452943395 · Twitter Post
• https://t.me/cvenotify/129167 · Telegram Post